The Reserve Bank of India (RBI) has published a draft amendment to its Know Your Customer (KYC) Directions that would introduce a standard operating procedure for suspected money-mule transactions and accounts linked to cyber-enabled financial fraud. The proposal is not a final rule. RBI says the amendment would take effect on April 1, 2027, or earlier if a bank elects to implement the procedure sooner.
The draft follows an August 4, 2026 Supreme Court order that RBI says directed it to adopt and circulate a procedure for temporary debit holds on amounts or accounts linked to money-mule activity and cyber-enabled financial fraud. The central question is operational as much as regulatory: how can a bank act quickly on a credible fraud signal while giving legitimate customers notice, a route to explain a transaction, and a defined path to release a hold?
What the draft would require
The proposed standard operating procedure would apply to commercial banks—including small finance banks, payments banks, regional rural banks and local area banks—and urban cooperative banks. It would not apply to listed special-purpose arrangements such as nodal, pool, escrow, dividend or share-capital accounts.
When a bank's fraud-risk controls identify a suspected money-mule transaction or account, the draft says the bank should place a temporary debit hold immediately on the transaction or, where the account itself is suspected, on the account. It characterizes account-level holds as a last resort for exceptional circumstances in the bank's internal policy.
The proposal also sets out a customer-notification requirement. A bank would need to explain the reason for the hold, the removal process and the relevant officer's contact details. For digital communications, notification would be immediate; otherwise, the draft specifies the end of the next day.
A defined review and release timeline
| Stage | Timeline Window | Required Action & Operational Mandate |
|---|---|---|
| 1. Detection & Hold | Immediate (Day 0) | Bank fraud risk controls flag transaction or account; temporary debit hold placed immediately. |
| 2. Customer Notice | Immediate / Next Day | Notice dispatched explaining hold reasons, nodal officer contacts, and dispute mechanisms. |
| 3. Customer Explanation | Within 20 Days | Account holder provided window to submit proof and justification of legitimate source of funds. |
| 4. Internal Bank Review | Within 10 Days | Bank reviews customer submission to either lift hold or escalate to jurisdictional police authorities. |
| 5. Law Enforcement Referral | By Day 30 | Unjustified transactions reported to police through National Cybercrime Portal / CFCFRMS. |
| 6. Mandatory Release | Day 60 (Statutory Max) | Hold removed on Day 31 post-referral or Day 60 maximum absent statutory/court extension orders. |
The draft gives an account holder 20 days from the temporary debit hold to submit an explanation or justification. Where an explanation is received, the bank would have 10 days to decide whether to remove the hold or continue it and report the matter to the jurisdictional police authority through the National Cybercrime Reporting Portal / CFCFRMS process. Where no explanation is received, the bank would make its decision within 30 days from the hold.
If a law-enforcement agency or competent authority provides an instruction backed by the appropriate statutory provisions, the bank would need to act immediately. If no instruction requiring continuation arrives within 30 days of the bank's reference to law enforcement, the draft says the hold should be removed on the 31st day. In the absence of a contrary instruction, the proposed maximum duration of a temporary debit hold is 60 days from the date it was placed.
The procedure would sit alongside existing obligations under the Prevention of Money Laundering Act and RBI's KYC Directions; it would not replace suspicious-transaction reporting to FIU-IND. The draft also calls for centralized management information, enhanced monitoring of relevant relationships, retention of hold-related records, designated nodal officers and a customer-grievance mechanism.
Implementation recommendations for banks
- Separate the draft from production policy. Do not represent this proposal as a binding requirement before RBI issues final directions. Assign an owner to track the consultation and compare the final text with current fraud operations.
- Map the evidence path. Test whether fraud and transaction-monitoring systems can document the signal that led to a hold, the scope of the hold, notices sent, customer explanations, case decisions and law-enforcement references.
- Design for timely review. A temporary control can become a customer-harm issue when its queue is unmanaged. Capacity planning should support the proposed 20-day explanation period, 10-day review window and release deadlines.
- Make account-level holds exceptional. The draft specifically points to account-level action as a last resort. Policies should distinguish a suspicious transaction from evidence that justifies restricting an entire account.
- Validate notification and escalation routes. Ensure digital and non-digital notification templates, nodal-officer contact details, grievance handling and law-enforcement workflows are current and auditable.
Why the draft matters
Money-mule controls sit at the intersection of fraud detection, payments operations, financial-crime compliance and customer service. The draft's value is not simply that it permits a hold; banks already operate under multiple legal and risk obligations. Its proposed contribution is a uniform, time-bound decision process that makes both intervention and release more accountable.
For security and fraud teams, the practical next step is readiness rather than premature implementation. Review the data sources used to identify suspected mule activity, the quality controls intended to minimize false positives, and the evidence retained for each action. Final requirements may change after the draft process, but organizations that can already explain why a hold was placed, how a customer was informed and when it must be reviewed will be better positioned for whatever final form the directions take.
